System, computer-readable medium, and method for blueprint-based cloud management

ABSTRACT

Systems, methods, and media for translating requests to acquire or change goods and services by receiving a request in a service catalog. The received request is received in a format that is not suitable for a target vendor. The received request is then translated into a format suitable for the target vendor. The translated received request is then transmitted to the vendor using the translated format.

BACKGROUND

The present disclosure relates in general to systems, methods, andapparatuses for providing cloud management.

This section is intended to introduce the reader to various aspects ofart that may be related to various aspects of the present disclosure,which are described and/or claimed below. This discussion is believed tobe helpful in providing the reader with background information tofacilitate a better understanding of the various aspects of the presentdisclosure. Accordingly, it should be understood that these statementsare to be read in this light, and not as admissions of prior art.

Computer resources (e.g., configuration items) hosted in distributedcomputing (e.g., cloud-computing) environments may be disparatelylocated with each having its own functions, properties, and/orpermissions. Such resources may include hardware resources (e.g.computing devices, switches, etc.) and software resources (e.g. databaseapplications).

BRIEF DESCRIPTION OF THE DRAWINGS

The description herein makes reference to the accompanying drawings,wherein like reference numerals refer to like parts throughout theseveral views.

FIG. 1 is a block diagram of a distributed computing system, inaccordance with an embodiment;

FIG. 2 is a block diagram of a generalized computing device utilized inthe distributed computing system of FIG. 1, in accordance with anembodiment;

FIG. 3 is a block diagram of an electronic computing and communicationsystem, in accordance with an embodiment;

FIG. 4 is an architectural overview of a cloud management platform formanaging the distributed computing system, in accordance with anembodiment;

FIG. 5 is a flow diagram of a blueprint operation performingorchestration, in accordance with an embodiment;

FIG. 6 is an architecture of an API used to utilize the cloud managementplatform of FIG. 4, in accordance with an embodiment;

FIG. 7 illustrates a flow of the platform through the API of FIG. 6, inaccordance with an embodiment;

FIG. 8 illustrates a resource block table utilized in the flow of FIG.7, in accordance with an embodiment;

FIG. 9 illustrates a communication process for delegating actions, inaccordance with an embodiment;

FIG. 10 illustrates a process for blueprint orchestration, in accordancewith an embodiment;

FIG. 11 illustrates a process for controlling a stack and order, inaccordance with an embodiment; and

FIG. 12 illustrates a process for ordering a good or service utilizing aservice catalog, in accordance with an embodiment.

DETAILED DESCRIPTION

One or more specific embodiments will be described below. In an effortto provide a concise description of these embodiments, not all featuresof an actual implementation are described in the specification. Itshould be appreciated that in the development of any such actualimplementation, as in any engineering or design project, numerousimplementation-specific decisions must be made to achieve thedevelopers' specific goals, such as compliance with system-related andenterprise-related constraints, which may vary from one implementationto another. Moreover, it should be appreciated that such a developmenteffort might be complex and time consuming, but would nevertheless be aroutine undertaking of design, fabrication, and manufacture for those ofordinary skill having the benefit of this disclosure.

Information Technology (IT) devices are increasingly important in anelectronics-driven world in which various electronic devices areinterconnected within a distributed context. As more and more functionsare performed by services using some form of distributed computing, thecomplexity of IT network management increases. As these devices areseparated geospatially, managing and tracking configuration of thesedevices may become more difficult.

As the use of cloud-based platforms in the technology industry continuesto evolve into more complex multi-cloud environments with a mix ofprivate and public cloud services, Cloud Management Platforms (CMPs) aregaining importance. CMPs are becoming an important component forsuccessfully leveraging multi-cloud environments because a CMPs includea suite of integrated tools that provide automated management of privateand public clouds. CMPs facilitate the operation and automation of cloudservices by eliminating the need for cloud specific interfaces and enduser knowledge of cloud underpinnings.

Specifically, a CMP may include capabilities providing self-serviceinterfaces for end user requests to a cloud service catalog offunctions, tracking and managing resource lifecycles, and monitoringevents and configuration information. CMPs provide an ability to build,provision, and launch application stacks. CMPs may also enable meteringand billing of resource consumption in the cloud platform. CMPs may alsobe used to control and govern policies, automation, and role-basedaccess control (RBAC). However, these functions may be complicated.Thus, to provide a suitable interface, automated CMP functions shouldintegrate with IT support to simplify functions for incident and problemmanagement, monitoring, change management (e.g., patch management,release management, configuration management, resource lifecyclemanagement, etc.), self-service user portals, usage reporting,configurable services (e.g., events, triggers, notifications, taskscheduling, etc.), service delivery management (e.g., resourceservice-level agreements), and other functions.

In other words, a CMP may be the central place where cloud managementactivities like provisioning and life cycle operations of cloudresources will take place even when the cloud services themselves may beprovided from other cloud vendors. For example, the cloud vendors mayinclude AWS, Azure, VMware, NetApp, and/or other cloud serviceproviders. CMP may provide integration with external applications ofthese cloud vendors to provision, discover and do life cycle operations.For example, the CMP may create/update configuration item (CI) recordsin a configuration management database (CMDB).

These integrations may include providing a consistent single CMDB cloudmodel which can be used by CMP, discovery, event management, and/orother functions. In some embodiments, platform bindings are utilized asmuch as possible to create a connected experience for the users.

As discussed herein, the consistent single CMDB cloud model works with acloud-agnostic blueprint-based system where cloud resources from one ormore providers can be assembled together and/or be deployed/managed asdesired. A blueprint is an operational tool that describes the natureand the characteristics of the service interaction in enough detail toverify, implement and maintain the service. Aninterface-and-implementation-based resource block ecosystem enablesthese blueprints to delegate the creation of the resources toappropriate resource blocks, when desired.

Furthermore, communication with external cloud systems (e.g., from otherproviders) may be established in a consistent manner using a cloud API(CAPI). CAPI provides a consistent layer and blueprints. In someembodiments, CAPI may also enable other entities to use CAPI tocommunicate with the clouds. CAPI may also provide a consistent way todiscover resources in the cloud. For example, CAPI may be integratedwith existing discovery processes for resources that are already beingdiscovered to extend functionality in a cloud provider-agnostic manner.

By way of introduction, FIG. 1 is a block diagram of a system 100 thatutilizes distributed computing framework, which may perform one or moreof the techniques described herein. As illustrated in FIG. 1, a client102 communicates with a platform 104 (e.g., a platform) over acommunication channel 106. The client 102 may include any suitablecomputing system. For instance, the client 102 may include one or morecomputing devices, such as a mobile phone, a tablet computer, a laptopcomputer, a notebook computer, a desktop computer, or any other suitablecomputing device or combination of computing devices. The client 102 mayinclude client application programs running on the computing devices.The client 102 can be implemented using a single physical unit or acombination of physical units (e.g., distributed computing) running oneor more client application programs. Furthermore, in some embodiments, asingle physical unit (e.g., server) may run multiple client applicationprograms simultaneously or separately.

The platform 104, such as a cloud service, may include any suitablenumber of computing devices (e.g., computers) in one or more locationsthat are connected together communicate using one or more networks. Forinstance, the platform 104 may include various computers acting asservers in datacenters at one or more geographic locations where thecomputers are connected together using network and/or Internetconnections. The communication channel 106 may include any suitablecommunication mechanism for electronic communication between the client102 and the platform 104. The communication channel 106 may incorporatelocal area networks (LANs), wide area networks (WANs), virtual privatenetworks (VPNs), cellular networks (e.g., long term evolution networks),and/or other network types for transferring data between the client 102and the platform 104. For example, the communication channel 106 mayinclude an Internet connection when the client 102 is not on a localnetwork common with the platform 104. Additionally or alternatively, thecommunication channel 106 may include network connection sections whenthe client and the platform 104 are on different networks or entirelyusing network connections when the client 102 and the platform 104 sharea common network. Although only a single client 102 is shown connectedto the platform 104, it should be noted that platform 104 may connect tomultiple clients (e.g., tens, hundreds, or thousands of clients).

Through the platform 104, the client 102 may connect to various deviceswith various functionality, such as gateways, routers, load balancers,databases, application servers running application programs on one ormore nodes, or other devices that may be accessed via the platform 104.For example, the client 102 may connect to an application server 107and/or databases, such as the configuration management database (CMDB)108, via the platform 104. The application server 107 may include anycomputing system, such as a desktop computer, laptop computer, servercomputer, and/or any other computing device capable of providingfunctionality from an application program to the client 102. Theapplication server 107 may include one or more application nodes runningapplication programs whose functionality is provided to the client viathe platform 104. The application nodes may be implemented usingprocessing threads, virtual machine instantiations, or other computingfeatures of the application server 107. Moreover, the application nodesmay store, evaluate, or retrieve data from a database and/or a databaseserver (e.g., the CMDB 108).

The CMDB 108 is a series of tables containing information about all ofthe assets and enterprise services controlled by a client 102 and theconfigurations of these assets and services. The assets and servicesinclude configuration items (CIs) 110 that may be computers, otherdevices on a network 112 (or group of networks), software contractsand/or licenses, or enterprise services. The CIs 110 include hardwareresources, such as server computing devices, client computing devices,processors, memory, storage devices, networking devices, or powersupplies; software resources, such as instructions executable by thehardware resources including application software or firmware; virtualresources, such as virtual machines or virtual storage devices; and/orstorage constructs such as data files, data directories, or storagemodels. As such, the CIs 110 may include a combination of physicalresources or virtual resources. For example, the illustrated embodimentof the CIs 110 includes printers 114, routers/switches 116, loadbalancers 118, virtual systems 120, storage devices 122, and/or otherconnected devices 124. The other connected devices 124 may includeclusters of connected computing devices or functions such as datacenters, computer rooms, databases, or other suitable devices.Additionally or alternatively, the connected devices 124 may includefacility-controlling devices having aspects that are accessible vianetwork communication, such as heating, ventilation, and airconditioning (HVAC) units, fuel tanks, power equipment, and/or the like.The CMDB 108 may include an index of CIs 110, attributes (e.g., roles,characteristics of elements, etc.) associated with the CIs 110, and/orrelationships between the CIs 110. Furthermore, the CMDB 108 may trackwhich configuration files identified pertain to each CI 110.

Additional to or in place of the CMDB 108, the platform 104 may includeone or more other database servers. The database servers are configuredto store, manage, or otherwise provide data for delivering services tothe client 102 over the communication channel 106. The database serverincludes one or more databases (e.g., CMDB 108) that are accessible bythe application server 107, the client 102, and/or other devicesexternal to the databases. The databases may be implemented and/ormanaged using any suitable implementations, such as a relationaldatabase management system (RDBMS), an object database, an extensiblemarkup language (XML) database, a configuration management database(CMDB), a management information base (MIB), one or more flat files,and/or or other suitable non-transient storage structures. In someembodiments, more than a single database server may be utilized.Furthermore, in some embodiments, the platform 104 may have access toone or more databases external to the platform 104 entirely.

In the depicted topology, access to the platform 104 is enabled via amanagement, instrumentation, and discovery (MID) server 126 via a queue128 (e.g., External Communications Channel Queue) and/or other queueingmechanisms. The MID server 126 may include an application program (e.g.,Java application) that runs as a service (e.g., Windows service or UNIXdaemon) that facilitates communication and movement of data between theplatform 104 and external applications, data sources, and/or services.The MID server 126 may be executed using a computing device (e.g.,server or computer) on the network 112 that communicates with theplatform 104. As such, in some embodiments, the MID server 126 mayconnect back to the platform 104 using a virtual private networkconnection that simulates the CIs 110 being connected to the platform104 on a common physical network.

As discussed below, the MID server 126 may periodically and/orintermittently use discovery probes to determine information on devicesconnected to the network 112 and return the probe results back to theplatform 104. Probes may have different types and functions. Forexample, some probes get the names of devices of specific operatingsystems (e.g., Windows or Linux) while other exploration probes returndisk information for those devices using the operating systems. Someprobes run a post-processing script to filter the data that is sent backto the platform 104.

As a non-limiting example, the probe types available for use by the MIDserver 126 may include a Shazzam probe that determines what devices areactive using a targeted port scan, a user-defined probe class, amulti-probe that combines probe types, and/or any combination thereof.Additionally or alternatively, the probe types may include any probetype that determines information about CIs 110.

In the illustrated embodiment, the MID server 126 is located inside thenetwork 112 thereby alleviating the use of a firewall in communicationbetween the CIs 110 and the MID server 126. However, in someembodiments, a secure tunnel may be generated between a MID server 126running in the platform 104 that communicates with a border gatewaydevice of the network 112.

The queue 128 may be a database table that is typically queried,updated, and inserted into by other systems. Each record in the queue128 is a message from an instance in the platform 104 to a system (e.g.,MID server 126) external to the platform 104 that connects to theplatform 104 or a specific instance running in the platform 104 or amessage to the instance from the external system.

The system 100 may also include/connect to one or more clouds 130 thatare external to the platform 104. For example, these clouds 130 may beprovided by other cloud providers and may include AWS, Azure, VMware,NetApp, and/or clouds from other cloud service providers. These clouds130 may also include their own CIs 110 that are accessed through theclouds 130 using CAPI, as previously noted. The MID server 126 may alsobe used to probe the clouds 130 using a CAPI probe 132.

The platform 104 may allocate resources to users or groups of users in amulti-tenant and/or a single-tenant architecture. Allocating resourcesin a multi-tenant architecture includes include installations orinstantiations of one or more servers, such as application servers,database servers, or any other server, or combination of servers, thatcan be shared amongst a group of users. For example, a web server, suchas a unitary Apache installation; an application server, such as aunitary Java Virtual Machine; and a single database server catalog, suchas a unitary MySQL catalog, may handle requests from multiple users. Ina multi-tenant architecture, the application server, the databaseserver, or both may distinguish between and segregate data or otherinformation of the various customers using the system. In summary,multi-tenant architecture provides a single instance of software and allof the supporting infrastructure of the software serves multiplecustomers. In other words, each user shares the software applicationprogram and a database. The database and the software applicationprogram tracks who the data belongs to.

In a single-tenant architecture (which can also be referred to as amulti-instance architecture), separate web servers, application servers,database servers, or combinations thereof may be provisioned for atleast some users or sub-users (e.g., sub-accounts) of those users. Inthe single-tenant architecture, one or more web servers are provided anddedicated to a user and/or sub-users of that user. Moreover,transactions are processed using one or more dedicated applicationservers, and data is stored in one or more database servers dedicated tothe user or sub-users of that user. In summary, a single-tenantarchitecture includes a single instance serves only a single user (andits sub-users). Thus, each user has its own database and instance of thesoftware application program. In other words, the database and thesoftware application program are not shared between users (outside of auser's sub-users) enabling data isolations, insurance of availability ofdata in response to a user's demands, and scalability of databases forupgrading/expansion.

In use, a user's instance may include multiple web server instances,multiple application server instances, multiple database serverinstances, and/or any combination thereof. The server instances may bephysically located on different physical servers and may share resourcesof the different physical servers with other server instances associatedwith other customer instances.

Although the system 100 is described as having the application servers107, the CMDB 108, the queue 128, the MID server 126, and the like, itshould be noted that the embodiments disclosed herein are not limited tothe components described as being part of the system 100. Indeed, thecomponents depicted in FIG. 1 are merely provided as example componentsand the system 100 should not be limited to the components describedherein. Instead, it should be noted that other types of server systemsmay communicate with the platform 104 in addition to the MID server 126.

Further, it should be noted that server systems described herein maycommunicate with each other via a number of suitable communicationprotocols, such as via wired communication networks, wirelesscommunication networks, and the like. In the same manner, the client 102may communicate with a number of server systems via a suitablecommunication network without interfacing its communication via theplatform 104.

In any case, to perform one or more of the operations described herein,the client 102, the application servicer 107, the MID server 126, andother server or computing system described herein may include one ormore of the computer components depicted in FIG. 2. FIG. 2 generallyillustrates a block diagram of example components of a computing device200 and their potential interconnections or communication paths, such asalong one or more busses.

In any case, to perform one or more of the operations described herein,the client 102, the application servicer 107, the MID server 126, andother server or computing system described herein may include one ormore of the computer components depicted in FIG. 2. FIG. 2 generallyillustrates a block diagram of example components of a computing device200 and their potential interconnections or communication paths, such asalong one or more busses. As briefly mentioned above, the computingdevice 200 may be an embodiment of the client 102, the applicationserver 107, a database server (e.g., CMDB 108), other servers in theplatform 104 (e.g., server hosting the queue 128), device running theMID server 126, and/or any of the CIs 110. As previously noted, thesedevices may include a computing system that includes multiple computingdevices and/or a single computing device, such as a mobile phone, atablet computer, a laptop computer, a notebook computer, a desktopcomputer, a server computer, and/or other suitable computing devices.

As illustrated, the computing device 200 may include various hardwarecomponents. For example, the device includes one or more processors 202,one or more busses 204, memory 206, input structures 208, a power source210, a network interface 212, a user interface 214, and/or othercomputer components useful in performing the functions described herein.

The one or more processors 202 may include processor capable ofperforming instructions stored in the memory 206. For example, the oneor more processors may include microprocessors, system on a chips(SoCs), or any other circuitry performing functions by executinginstructions stored in the memory 206 or in other accessible locations.Additionally or alternatively, the one or more processors 202 mayinclude application-specific integrated circuits (ASICs),field-programmable gate arrays (FPGAs), and/or other devices designed toperform some or all of the functions discussed herein without callinginstructions from the memory 206. Moreover, the functions of the one ormore processors 202 may be distributed across multiple processors in asingle physical device or in multiple processors in more than onephysical device. The one or more processors 202 may also includespecialized processors, such as a graphics processing unit (GPU).

The one or more busses 204 includes suitable electrical channels toprovide data and/or power between the various components of thecomputing device. For example, the one or more busses 204 may include apower bus from the power source 210 to the various components of thecomputing device. Additionally, in some embodiments, the one or morebusses 204 may include a dedicated bus among the one or more processors202 and/or the memory 206.

The memory 206 may include any tangible, non-transitory, andcomputer-readable storage media. For example, the memory 206 may includevolatile memory, non-volatile memory, or any combination thereof. Forinstance, the memory 206 may include read-only memory (ROM), randomlyaccessible memory (RAM), disk drives, solid state drives, external flashmemory, or any combination thereof. Although shown as a single block inFIG. 2, the memory 206 can be implemented using multiple physical unitsin one or more physical locations. The one or more processor 202accesses data in the memory 206 via the one or more busses 204.

The input structures 208 provide structures to input data and/orcommands to the one or more processor 202. For example, the inputstructures 208 include a positional input device, such as a mouse,touchpad, touchscreen, and/or the like. The input structures 208 mayalso include a manual input, such as a keyboard and the like. Theseinput structures 208 may be used to input data and/or commands to theone or more processors 202 via the one or more busses 204. The inputstructures 208 may alternative or additionally include other inputdevices. For example, the input structures 208 may include sensors ordetectors that monitor the computing device 200 or an environment aroundthe computing device 200. For example, a computing device 200 cancontain a geospatial device, such as a global positioning system (GPS)location unit. The input structures 208 may also monitor operatingconditions (e.g., temperatures) of various components of the computingdevice 200, such as the one or more processors 202.

The power source 210 can be any suitable source for power of the variouscomponents of the computing device 200. For example, the power source210 may include line power and/or a battery source to provide power tothe various components of the computing device 200 via the one or morebusses 204.

The network interface 212 is also coupled to the processor 202 via theone or more busses 204. The network interface 212 includes one or moretransceivers capable of communicating with other devices over one ormore networks (e.g., the communication channel 106). The networkinterface may provide a wired network interface, such as Ethernet, or awireless network interface, such an 802.11, Bluetooth, cellular (e.g.,LTE), or other wireless connections. Moreover, the computing device 200may communicate with other devices via the network interface 212 usingone or more network protocols, such as Transmission ControlProtocol/Internet Protocol (TCP/IP), power line communication (PLC),WiFi, infrared, and/or other suitable protocols.

A user interface 214 may include a display that is configured to displayimages transferred to it from the one or more processors 202. Thedisplay may include a liquid crystal display (LCD), a cathode-ray tube(CRT), a light emitting diode (LED) display, an organic light emittingdiode display (OLED), or other suitable display. In addition and/oralternative to the display, the user interface 214 may include otherdevices for interfacing with a user. For example, the user interface 214may include lights (e.g., LEDs), speakers, haptic feedback, and thelike.

FIG. 3 is a block diagram of an embodiment of an electronic computingand communication system 300 for discovering and/or managing connectedCIs. The electronic computing and communication system 300 includes oneor more environments such as environments 302 and 304 each includingresources 306 and 308, respectively. Each environment 302, 304 mayinclude one or more networks coupling resources together in alocation-based, function-based, and/or common credentials-basedgrouping. For example, the environments 302, 304 may include a customerservice environment used to represent customer service infrastructure ina technical support, sales, billing, and/or other groupings.

For example, the environments 302, 304 may include a datacenter and alldevices coupled to one or more networks located at the datacenter.Additionally or alternatively, the environment 302, 304 may bedistributed across multiple geographical locations. Thus, theenvironment 302, 304 may include any devices that are accessible by auser account including resources that may be spatially distant from eachother. In some embodiments, resources 306, 308 of the environments 302,304 may communicate with each other across environments. However, insome embodiments, aspects of various environments may be provided bydifferent vendors without communication therebetween. In suchembodiments, the resources of disparate environments may communicateusing the platform 104 (e.g., a configuration management service 310that is a part of the platform 104 including the CMDB 108). Theresources 306 and 308 may include any of the CIs 110 previouslydiscussed.

The configuration management service 310 may include one or more serversproviding access to and managing the CMDB 108. The configurationmanagement service 310 may allocate or provision resources, such asapplication instances in the resources 306 or 308 from a respectiveenvironment 302 or 304. Further, the configuration management service310 may create, modify, or remove information in the CMDB 108 relatingto the resources 306 or 308. Thus, the configuration management service310 may manage a catalogue of resources in more than a singleenvironment (even if the environments may not directly communicate witheach other). Using this catalogue, the configuration management service310 may discover new resources, provision resources, allocate resources,modify, and/or remove resources from the catalogue across a singleenvironment or multiple environments. In some embodiments, these actionsmay be initiated using the client 102, scheduled for periodic occasions(e.g., periodic discovery), or a combination thereof. For example, aclient 102 may receive a request, via its input structures, to query anidentity of an application program interface (API) used by a resource toaccess a particular vendor/provider for the environment 302 that ispassed to the configuration management service 310 to query the CMDB108. As another example, the client 102 may receive a request, via itsinput structures, to query an identity of a user authorized to access aparticular resource that is passed to the configuration managementservice 310.

As previously discussed, the CMDB 108 may be populated utilizing adiscovery process which may be used to discover the resources 306 or308. Moreover, as previously discussed, the discovery process mayinclude determining the properties or attributes of the resources 306 or308 in their respective environments 302 or 304 using a respective MIDserver 126A or 126B. In the illustrated embodiment, each environment 302and 304 has its own MID server 126A and 126B. In some embodiments, asingle MID server 126A or 126B may be employed when the MID server mayreach into multiple environments. For example, if the MID server 126A or126B is run in the platform 104 (e.g., in the configuration managementservice 310), a single MID server 126A or 126B may be used to manageboth environments 302 and 304. Additionally or alternatively, if the MIDserver 126A has access to the environment 304, the MID server 126B maybe omitted.

FIG. 4 illustrates a CMP architectural overview of a CMP architecture400. The CMP architecture 400 includes various interaction/interfacelayers. For example, the CMP architecture 400 also includes a a servicedesign interface 402. The service design interface 402 enables servicecategory managers/editors use to create and edit services. When theservice design is complete, the managers/editors may publish it tocreate a catalog item that end users can request and/or use to requestgoods and/or services (e.g., laptop with a service agreement). Aninfrastructure setup interface 404 enables management/editing of astored infrastructure for the service including discovery processes usedto discover connected CIs 110. A management portal 406 is used toadministrate, manage, and/or run reports on the services. A cloud userportal 408 enables users to request management perform actions, accessthe service catalog that is populated with services from the servicedesigner.

The CMP architecture 400 also includes a stack orchestration includingvarious services available for the platform 104. The CMP architecture400 also includes dynamic service forms 410 that are used to addservices from the catalog using a catalog item. The CMP architecture 400also includes a blueprint operation processor 412 that is used toperform operations on/with the blueprint. The CMP architecture 400includes a policy engine 414 that may be used to set rule on how, when,and/or how often to perform various operations. The CMP architecture 400also includes a resource pool service 416 that enables pooling resourcesin the platform 104. The CMP architecture 400 also includes a quotaservice 416 that may be used to define a quota policy for differenttypes of transactions. A transaction quota cancels any transaction inviolation of the policy and notifies the user of the cancellation. TheCMP architecture 400 also includes a blueprint validator 420. Theblueprint validator 420 ensures that the blueprint is valid using one ormore authentication schemes, such as Digital Signature Service (DSS).The blueprint validator 420 may also schedule execution of theblueprint.

Moreover, the CMP architecture 400 includes resource block APIs. The CMParchitecture 400 includes a compute service 422 that may calculateinformation about a service level agreement (SLA) or other computations.The CMP architecture 400 also includes a storage service 424 thatprovides an ability to store data, manage data storage, change storageallocations, and/or other storage management operations. The CMParchitecture 400 also includes a network service 426 that is used to runan Active Directory (AD). The CMP architecture 400 also includes a loadbalancing service 428 that balances loading between various resourcesin/connected to the platform 104. The CMP architecture 400 also includesa firewall service 430 that blocks unauthorized communications fromoutside of the platform 104. The CMP architecture 400 also includes anInternet Protocol Address Management (IPAM) service 432 that plans,tracks, and manages the IP address space used in the platform 104 byintegrating Domain Name System (DNS) and Dynamic Host ConfigurationProtocol (DHCP) to ensure that duplicate addresses do not exist in theplatform 104. The CMP architecture 400 also includes an Operating System(OS) bootstrap service 434 that causes the OS to startup on demand.

Furthermore, the CMP architecture 400 includes a cloud accountidentifier that identifies the cloud account 436 running one or moreinstances on the application server 107. The CMP architecture 400 alsoincludes an AD service 438 that includes a variety of directory-basedidentity-related services. The CMP architecture 400 also includes anIPAM provider 438 that helps implement that IPAM service 432 acrossconnected devices. The CMP architecture 400 may also include scriptproviders 440 that include scripts that may be run in the platform 104.

As previously noted, communication between the platform 104 and theclouds 130 may utilize a CAPI 442 to enable CMP probing, routing, andconnector frameworks 444. Using the CAPI 442, the platform mayaccess/interact with the clouds 130 in a provider-agnostic andconsistent manner.

FIG. 5 illustrates a flow of an example blueprint operation performingorchestration (i.e., automation) in the platform 104. Using the servicedesign interface 402, a CMDB designer 502 is used to design aconfiguration item type by defining attributes and relationships for theCI types. A resource block designer 506 is used to create a resourceblock for each CI type and define lifecycle operations to manage the CI110. A blueprint designer 508 is used to design a cloud service topologyby specifying resource blocks and their relationships for the cloudservice topology. The result of this specification results in ablueprint intent template in a domain-specific language (DSL) 510 and aservice model 512 that may be used in service mapping and/or otherservice management operations. The blueprint intent template mayillustrate the intent of the deployment in a graphical or data-oriented(e.g., YAML) format using existing resource blocks. The blueprintdesigner 508 also generates a blueprint orchestration template thatdefines the lifecycle operations for the cloud service into a blueprintorchestration DSL 512. Furthermore, the blueprint designer 506 alsogenerates/adds to a service catalog that includes by adding one or moreavailable goods and/or services to the service catalog. Generating theservice catalog includes defining dynamic service forms 410 foroperations for the cloud service and publishing blueprints to servicesfor the catalog.

Later, at runtime, a service catalog item is requested 514 filling inone or more of the dynamic service forms 410. One of the forms of thedynamic service forms 410 is filled out of the specific blueprint as aprovision operation form. The filling out and/or acting upon this formis governed by the form itself and/or form rules (block 516). The formmay also show a price and a quota (to be added to quota service 418) inthe form.

Also, at runtime, a blueprint orchestrator 517 (e.g., blueprintoperation processor 412) is used to cause creation of a new stackmanager service 518, application of policy 520, validation of theblueprint 522, and cause execution of a stack service 524. The stackmanager service 518 creates an order identifier that identifies an orderof operation of services, blueprints, and/or other operations. The stackmanager service creates an empty stack and creates a blueprint DSS DSL.Application of policy 520 includes using the policy engine service 414to apply policy for the blueprint orchestration DSL 512 and updating theblueprint DSS DSL. Validation of the blueprint includes validating theblueprint DSS DSL for cloud match, permissions, quota, capacity, andlicensing. Execution of the stack service 524 includes taking theblueprint orchestration DSL and generating an API route template that issent to CAPI orchestrator 526. In some embodiments, after each APIoperation is performed and/or sent to the CAPI orchestrator 526, the CIs110, a stack state, and the DSS is updated 528.

The CAPI orchestrator 526 takes configuration parameters and APIparameters and applies API endpoint bindings to generate a runnable APIroute and sends this API route DSL 532 back through the queue 128 to theMID server 126 (block 530). The connection between the MID server 126and the CAPI orchestrator 526 may utilize a firewall 534. Similarly,connections between the MID server 126 via the CAPI probe 132 mayutilize firewalls 534 in some embodiments.

CAPI provides an abstracted API interface from the different providersby calling the third-party APIs directly, stitching APIs, providingcredential and/or access control, handling responses, handling errors,and/or providing debugging interfaces. Furthermore, CAPI frameworkprovides an ability to define API end points to talk to third-partyapplications/systems in an agnostic manner, support for common tools(e.g., common enterprise integration patterns), an ability to invokeAPIs based on standard interfaces, support API flow DSL, an ability toextend and configure the CAPI, support for dynamic stitching of APIs,support many transports, and/or expose endpoints as Uniform ResourceIdentifiers (URIs). In other words, the CAPI enables interaction with awide variety of service providers used to provide clouds 130 in a waythat isolates the users from differences in API implementation. Forinstance, an out-of-the-box API library may be included in the CAPI forcommonly used cloud providers. However, this API library may beexpanded/updated by users, management, and/or service providers.

FIG. 6 illustrates an architecture 550 of the CAPI. The CAPIarchitecture 550 includes one or more of the following interfaces:compute interface 552, block storage 554, firewall 556, network 558,blob storage 560, load balancer 562, IPAM 564, configuration management566, and/or other interfaces. The compute interface 552 may be includedin, interface with, and/or be similar to the compute service 422. Theblock storage 554 and blob storage 560 interfaces may be included in,interface with, and/or be similar to the storage service 424. Thefirewall 556 interface may be included in, interface with, and/or besimilar to the firewall service 430. The network interface 558 may beincluded in, interface with, and/or be similar to the network service426. The load balancer 562 interface may be included in, interface with,and/or be similar to the load balancer service 428. The IPAM 564 may beincluded in, interface with, and/or be similar to the IPAM service 432and/or the IPAM provider 438. The configuration management interface 566provides an interface to configure the CAPI. The interfaces are used toconnect to APIs 568 for various cloud providers. The CAPI may handle APIflow to the APIs 568, may validate inputs to the APIs 568, transformcode from a provider-agnostic language to one used by the APIs 568,selecting a provider from the various providers, handling errors to/fromthe APIs 568 and the platform 104, and/or waiting. Selecting theprovider may be guided by enterprise rules, such as price limits,preferred vendors, geographic locations of services offered by eachvendor, whether vendor's datacenter is already used for similar serviceseither to group services and/or diversify services, and/or other factorsthat may be used to determine which vendor to acquire goods and/orservices from.

Furthermore, the CAPI may include a message filter that filters messagesfor an appropriate service provider, content-based flows, and/or loggingof translations and/or other operations. To perform these operations,the CAPI may include connectors 570, 572, 574, and 576. The CAPI mayinclude any number of connectors. One or more of the APIs may share aconnector when sharing commonalties (e.g., common enterprise integrationpatterns). For example, connector 570 may provide an interface for cloudprovider APIs 568A, 568B, 568C, and 568D. For example, API 568A may beused for AWS, API 568B may be used for Azure, API 568C may be used forVMWare, and API 568D may be used for OpenStack. Other connectors may beused for other providers. For example, an enterprise storage connector572 may be used to interface API 568E (e.g., NetApp). An OS scriptconnector 574 may be used to interface API 568F (e.g., VMWare View). SSHconnector 576 may be used to interface an SSH driven cloud API 568G.Additionally or alternatively, other API interfaces may be provided inthe CAPI.

FIG. 7 illustrates a flow 590 of the platform 104 through the CAPI 592to the clouds 130. The CAPI 592 receives API functions 594, 596, and 598from the platform 104. These APIs 594, 596, and 598 are illustrated asJava, Javascript, and REST APIs, respectively. However, in someembodiments, the APIs 594, 596, and 598 may include only a single APItype at a time. In some embodiments, these APIs may be stitched togetherto form a single runnable DSL. Moreover, in some embodiments, the APIs594, 596, and/or 598 be supplemented by and/or replaced by othersuitable APIs types. The functions of the APIs 594, 596, and 598 arepassed through a CAPI Interface 600. These functions are then passedthrough CAPI API implementation 602 that provides performs logic oncommunications through the CAPI interface 600 and/or the queue 128. Forexample, the CAPI API implementation 602 may utilize one or moreprocessors to drive API orchestration by creating the runnable API DSL532. The CAPI 592 also includes CAPI connectors 604 (e.g., connectors568) that provide integration with third-party applications (e.g., thethird-party APIs). The CAPI connector framework contains endpoints thatcan send and receive messages. In embodiments, the CAPI connector maygenerate skeleton sources and tests to create a new component tointeract with a third-party system. Moreover, the CAPI connector maygenerate build scripts to build and test this new component.

The CAPI orchestrator also may utilize a credential resolver 606 toprovide credentials specific to the cloud provider used for a particularcloud 130. The CAPI orchestrator may also utilize a parameter resolver608 to convert parameters from a runnable API DSL 532 to a language usedby the API of the specific provider for the particular cloud 130. Thisrunnable API DSL 532 was passed from the CAPI 592 to the MID server 126via the queue 128. In some embodiments, the credential resolver 606and/or the parameter resolver 608 may be located in the CAPI probe 132.

The CAPI 592 may return an output to a calling layer. Moreover, in someembodiments, the CAPI 592 may translate a response from the clouds 130and/or the MID server 126.

The CAPI probe 132 may run on the MID server 126 and decode a payloadfor an incoming message from the clouds 130. Furthermore, the CAPI probe132 may execute messages using an API executor and obtains API responsesfrom the clouds 130 and returns them to the CAPI 592 via the queue 128.

As previously noted, resource blocks are the basic building block ofblueprints. Each resource block is tied to a CMDB CI type, and theresource block behaviors are implemented as operations. These operationsmay be exposed through guest interfaces. Each resource block can sit onany other resource block which matches its host interface. Each resourceblock can have a set of other resource blocks that can be hosts for therespective resource block. Blueprint wiring between resource blocks maybe driven/validated using this principle. For example, an exampleresource block table structure 610 for a resource block 612 isillustrated in FIG. 8. Operations provide the behavior of the resourceblock. A resource block can implement multiple guest interfaces. Each ofthe interfaces have their own operations. Operation invocations may havetheir interface specified. Moreover, each resource block may have a hostinterface. In some embodiments, only those resources that implement thishost interface can become hosts for this resource block. The resourceblock operation can communicate to external systems (e.g., clouds 130)by directly calling CAPI and/or delegating to a host via a hostinterface call. The delegation communication method enables latebinding. FIG. 9 illustrates this communication process 650. A resourceblock 652 has an operation 654 that defines its behavior. Via theoperation 654, the resource block 652 may directly call the CAPI 592.Additionally or alternatively, the operation 654 may delegate such callsto its host resource block 656 based on its host interface 658. The hostresource block 656 then sends the delegated call to the CAPI 592. TheCAPI 592 used the API call to communicate with resource providers 660(e.g., clouds 130) similar to those steps discussed above.

As previously noted, a blueprint is a deployment definition of cloudservice model (including workloads). Workload consists of variousinterconnected resources. The blueprint is a template for creatingworkloads consistently across clouds. The blueprint has set ofoperations which takes inputs and orchestrates the deployment. Theblueprints interact with resources and CIs 110. The blue prints use theoperations defined in the resource blocks to build an automation flow.When a resource operation is executed, a CI is written back as per theassociation of the resource block and the CI type. For example, a CloudModel API Service may be used to write the data back to the CI as wellto the stack associated metadata. In some cased, much of the cloudinfrastructure resources are common across the various clouds. Thus, theCMP may support same blueprints to be deployed across different clouds.The system will use resource block hosts and service model constraintsto figure out the proper hosts.

A resource on a blueprint can have multiple possible hosts. Thus, hostresolution may be performed as follows: any given resource can have aset of hosts based on the host interface, service model “constraints”may identify the host, the guest interface may be deployed on the hostinterface and constraints indicate which hosts are applicable, and/or adesigner may restrict hosts using restriction expressions. For example,a designer may enter “in (AWS Datacenter, vSphere Datacenter)” torestrict hosts to AWS or vSphere.

Each blueprint has a set of operations that by default are created withit. When a resource block is connected to a host resource, CMPautomatically associates the resource operation automatically. Forexample, assume that a virtual server is connected to a first cloudservice provider (e.g., AWS Datacenter). CMP may automatically add thevirtual server's provision operation to blueprint's provision operation.Moreover, in some embodiments, CMP may also automatically add thevirtual server's stop, start and other operations as well to theblueprint's respective operations. Each blueprint operation type may bebottom up or top down. Some operations, like the provision operation orstart operation, may process (e.g., provision) the bottommost resourcesfirst and then process toward the top. For example, a virtual machinewould be provisioned before provisioning server software (e.g., Apache).

Some operations, such as a deprovision operation or stop operations,process (e.g., deprovision) top resources first and then moves down toprocess the remaining resources. For example, server software (e.g.,Apache) is deprovisioned before deprovisioning a virtual machine onwhich the software runs. CMP will determine this approach and add theresource steps automatically thereby potentially saving time and/orcosts to the company and/or the designer.

FIG. 10 illustrates a process 700 for blueprint orchestration. When ablueprint operation is invoked, the blueprint orchestrator service 517is called. An order 702 may be created in an order service 704.Responsive to the order creation, blueprint operation will invokepolicies, check quota, and a stack service 706 is called. Then theorchestration service 708 determines which resource operations that arebe invoked. The blueprint orchestration service 517 performs adepth-first on the resource operation to figure out the list of CAPI 592calls using a response processor 710, cloud model API 712, and probesensors 714. For each of the CAPI 592 calls, the blueprint orchestrationservice 517 will invoke the CAPI 592 using a CAPI invoker service 716.When all the calls are completed, the orchestration service updates thestatus of the order and the stack with an orchestration complete message720.

FIG. 11 illustrates a process 730 for controlling a stack and order.When a catalog item is accessed, the catalog item may utilize a workflow732. For example, the catalog item may be an item in a service catalogused to order goods and/or services (e.g., a laptop with a serviceagreement). The catalog item workflow 732, in turn, calls the orderservice and stack operation 734 (e.g., order service 704). The orderservice and stack operation 734 creates an order 736 and triggers theblueprint orchestration 517 and creates/updates a stack 738. Theblueprint orchestration 517 generates orchestration details 740 andreturns back an order identifier while calling 742 CAPI 592 whenwarranted and updating 744 CIs 110 when warranted. The blueprintorchestration 517 invokes policies and checks quotas, as previouslydiscussed. The blueprint orchestration 517 eventually completes andupdates the status of the stack and order 746. Control then returns backto the catalog item workflow 732.

FIG. 12 provides a summary over the process 750 reflecting relationshipsbetween various components of the system 10. A CI 110 is populated intoa CMDB 107 using discovery 752. A resource block 754 then references theCI 110. The resource block is used in a blueprint intent 508 in adata-oriented language (e.g., YAML). The blueprint intent 508 is used togenerate a blueprint with orchestration DSL 512. The blueprint withorchestration DSL 512 is used to create a service catalog item 756. Theservice catalog item 756 is used to order the service from the servicecatalog and run the blueprint orchestration 517. For example, theservice (e.g., leasing a server rack) may be ordered through a specificvendor based on enterprise rules, such as price. The blueprintorchestration 517 utilizes the orchestration service 708, cloud account758, governance rules 760, CAPI 592, credential resolver 606, servicemodel target service stage 762, and/or service model actual servicestate 764 to create/update a stack service 706. The governance rules 760may include rules used to choose a vendor for the service when the orderdoes not include an indication of a vendor. If the order indicates avendor, the indicated vendor used. This stack service 706 once createdmay also be used by the blueprint orchestration 517 to perform futureupdates to the stack service 706. Furthermore, the blueprints used bythe blueprint orchestrator may be vendor agnostic with connections usedto convert the vendor-agnostic language to a language suitable for atarget vendor. The language suitable for the target vendor is used toacquire at least a portion of the good and/or services from the vendor.

The techniques presented and claimed herein are referenced and appliedto material objects and concrete examples of a practical nature thatdemonstrably improve the present technical field and, as such, are notabstract, intangible or purely theoretical. Further, if any claimsappended to the end of this specification contain one or more elementsdesignated as “means for [perform]ing [a function] . . . ” or “step for[perform]ing [a function] . . . ”, it is intended that such elements areto be interpreted under 35 U.S.C. 112(f). However, for any claimscontaining elements designated in any other manner, it is intended thatsuch elements are not to be interpreted under 35 U.S.C. 112(f).

What is claimed is:
 1. A system for tracking configuration file changescomprising: non-transitory memory; and one or more hardware processorsconfigured to read instructions from the non-transitory memory toperform operations comprising: receiving an order pertaining to aservice catalog, wherein the service catalog comprises offers of a goodor a service; translating a blueprint to a format suitable for aselected vendor using a cloud application programming interface (CAPI)utilizing one or more connectors to map blueprint actions to avendor-specific format, wherein the blueprint is agnostic to whichvendor of a plurality of vendors is selected for the good or theservice; identifying commonalities between two or more APIs of aplurality of APIs; causing the two or more APIs for the plurality ofvendors to be joined together using connectors that combine thecommonalities between the two or more APIs; sending the vendor-specificformat to the vendor to acquire the good or the service using the joinedtogether APIs; performing discovery of the good or the service using theCAPI in a vendor-agnostic manner that isolates users from vendor APIdifferences between the plurality of APIs of different vendors; andrequesting that the CAPI update a configuration item entry for the goodor the service, wherein the configuration item entry is in aconfiguration management database of a cloud system configured to storeone or more configuration item entries, wherein the configurationmanagement database is used in a cloud management platform.
 2. Thesystem of claim 1, wherein the blueprint is generated using a blueprintintent template that graphically illustrates an intent of a deploymentof the blueprint.
 3. The system of claim 2, wherein the blueprint intenttemplate comprises a data-oriented format using resource blocks.
 4. Thesystem of claim 1, wherein the blueprint includes a runnabledomain-specific language (DSL) instruction.
 5. The system of claim 4,wherein the operations comprise generating a service catalog item usingthe DSL instruction.
 6. The system of claim 1, wherein the operationscomprise discovering the good or the service as the configuration itementry to populate the configuration management database.
 7. The systemof claim 1, wherein the operations comprise generating a resource blockreferencing the configuration item entry.
 8. The system of claim 1,wherein the operations comprise selecting the vendor from the pluralityof vendors using a rule to determine which vendor of the plurality ofvendors to use.
 9. The system of claim 8, wherein the rule includesselecting the good or the service based at least in part on a lowestprice for the good or the service from the plurality of vendors.
 10. Thesystem of claim 8, wherein the rule includes selecting the good or theservice based at least in part on an available location from each of theplurality of vendors.
 11. The system of claim 8, wherein the ruleincludes selecting the good or the service based at least in part onwhether the selected vendor is already used for other goods or services.12. Non-transitory, tangible, and computer-readable medium havinginstructions stored thereon that, when executed by one or moreprocessors, are configured to cause the one or more processors to:present a service catalog to offer an item; receive an order to acquirethe item through the service catalog without specifying a vendor from aplurality of available vendors for the item; select the vendor from theplurality of available vendors for the item based at least in part on aset of rules; identify commonalities between two or more APIs of aplurality of APIs; call a cloud application programming interface (CAPI)to convert vendor-agnostic instructions in the order intovendor-specific instructions by causing the two or more APIs for theplurality of available vendors to be joined together using connectorsthat combine the commonalities between the two or more APIs; use thevendor-specific instructions to communicate with the vendor; and requestthat the CAPI update a configuration item entry for the item, whereinthe configuration item entry is in a configuration management databaseconfigured to store one or more configuration item entries, wherein theconfiguration management database is used in a cloud management platformfor a cloud.
 13. The non-transitory, tangible, and computer-readablemedium of claim 12, wherein the set of rules comprises a location-basedrule, a price-based rule, a quota-based rule, or a combination thereof.14. The non-transitory, tangible, and computer-readable medium of claim12, wherein the one or more processors are configured to receive arequest to perform operations on the item.
 15. The non-transitory,tangible, and computer-readable medium of claim 14, wherein, responsiveto receiving the request, the one or more processors are configured tocreate or update a stack to communicate with the vendor usingvendor-specific instructions, wherein the vendor-specific instructionscomprise instructions translated into the vendor-specific instructionsusing a connector of the connectors each having a different connectortype, wherein the connector has a connector type corresponding to theselected vendor.
 16. A method comprising: receiving a command from aservice catalog item in a service catalog used to offer a service in avendor-agnostic presentation, wherein the command is received in avendor-agnostic format; selecting a vendor-specific connector based atleast in part on a target vendor of a plurality of vendors; identifyingcommonalities between two or more APIs of a plurality of APIs;translating the command into a vendor-specific format using thevendor-specific connector using a cloud application specific interface(CAPI) by causing the two or more APIs for the plurality of vendors tobe joined together using a multiple-vendor connector that combines thecommonalities between the two or more APIs; sending the translatedcommand to the target vendor to acquire the service; and requesting thatthe CAPI update a configuration item entry for the item, wherein theconfiguration item entry is in a configuration management databaseconfigured to store one or more configuration item entries including theconfiguration item entry, wherein the configuration management databaseis used in a cloud management platform for a cloud.